[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: TLS Info?



Eric Nichols wrote:
Jittinan Suwanrueangsri wrote:
Eric Nichols wrote:
I have not been able to figure out how to dump more info on the
encryption levels, certificate CN&  expiration date etc.  Should this
be done through the openssl functions?  If so, what do I hook them to?

Have you try with "slapd -d trace" option ?

you can get more description of each debugging level from "man slapd.conf"


I'm more interested in the lib calls.  I'm trying to write a program to
pull this information when I connect to an LDAP server over SSL.

There are no public APIs for retrieving this info. You can retrieve the SSL session handle from the LDAP* handle using

	SSL *s;
	ldap_get_option( ld, LDAP_OPT_X_TLS_SSL_CTX, &s );

You can get the encryption level using
	ldap_pvt_tls_get_strength( s );

You can get the DN of your certificate using
	struct berval dn;
	ldap_pvt_tls_get_my_dn( s, &dn, NULL, 0 );

You can get the DN of the peer certificate using
	ldap_pvt_tls_get_peer_dn( s, &dn, NULL, 0 );

Note that these functions are private to OpenLDAP's implementation, and are not specified in any API standard, and are subject to change without notice.

There is no libldap function for returning the cert expiration date; since the OpenSSL library already does cert validation checks we've never needed a function to pull this out on its own. To do anything else you'll have to use the OpenSSL functions directly.

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/